"Using a Least-Privileged User Account" OR "Woohoo, I've been published on microsoft.com!"

re: "Using a Least-Privileged User Account" OR "Woohoo, I've been published on microsoft.com!"

Will — Wed, 19 Jan 2005 21:27:00 GMT

My company has a software product that's running on kiosk-type equipment out in the field during its beta testing. These are XP machines, and the program is run under a user who is a member of the Power user's group (we did that because of some of the system access it required). We just found that one of the units had gotten infected with a virus that's working its way through the network of the location where the unit was installed. We're not sure which virus it is, but I was surprised the amount of damage that could be done to an operating system by a power user.

re: "Using a Least-Privileged User Account" OR "Woohoo, I've been published on microsoft.com!"

Jenni Merrifield (strawberryJAMM) — Wed, 26 Jan 2005 01:50:00 GMT

Will:

You're absolutely right, the Power User group has far too many rights to be that useful from a security restriction point of view. It's also childishly easy for bad code to elevate to Admin from an account with Power User rights.

Over here, we generally suggest that you forget Power User even exists because it just gives you a false sense of security. Either use Admin or User, and if you don't need to be Admin but you do need more than a traditional User, start with User rights and then add just the permissions that the process actually needs.